Quick answer: Platforms detect multi-accounting by correlating five signal categories simultaneously: shared cookies or session tokens, matching IP addresses or subnet history, identical payment instruments, overlapping browser fingerprints (canvas hash, WebGL, fonts), and behavioral patterns (timing, scroll depth, device cadence). Matching on two or more signals is typically enough to cluster accounts together in platform risk systems.
Risk teams and operators researching how to detect multi-accounting are asking from different sides of the same problem — platforms trying to enforce account limits, and operators trying to understand what signals to clean up before scaling. Both benefit from knowing exactly which data points feed the linking system.
The Five Primary Detection Signal Categories
| Signal Category | What Platforms Read | Risk Weight |
|---|---|---|
| Cookie / session tokens | Shared auth cookies or session IDs across accounts | 🔴 Very high — near-certain link |
| IP address / subnet | Same IP or datacenter ASN across multiple logins | 🔴 High — especially datacenter IPs |
| Payment instruments | Shared card BIN, billing name, or address | 🔴 High — payment processor level link |
| Browser fingerprint | Canvas hash, WebGL renderer, fonts, screen resolution | 🟡 Medium-high — resolved by anti-detect |
| Behavioral signals | Timing patterns, scroll velocity, click cadence, automation flags | 🟡 Medium — harder to spoof |
How Platforms Combine Signals: Graph Clustering
No platform bans an account for matching on one signal alone — a shared residential IP could legitimately mean two users on the same coffee shop network. The risk systems run graph analysis: accounts that share two or more signals get clustered together in a linked-accounts graph, and the confidence score rises with each additional matching signal. For the underlying fingerprint accuracy, see how accurate browser fingerprinting is.
A shared canvas hash plus a shared residential IP subnet raises enough confidence to trigger a manual review queue on most major ad platforms. Add a shared payment method BIN and the cluster is essentially confirmed from the platform’s perspective. The cascade result: one account in the cluster gets banned, the platform audits all cluster members, and linked accounts are banned or suspended in sequence.
The Cascade Ban Problem
Operators who get one account banned and immediately open a new account on the same machine with the same proxy and browser have not solved the detection problem — they have added a new account to an existing cluster. The platform’s risk system already has the fingerprint and IP on record. The new account inherits the ban risk from the first. Always open replacement accounts with a fresh fingerprint profile, a new proxy that has never appeared in the banned cluster, and ideally a different payment method.
The cascade ban is the highest-cost outcome of poor isolation. When the risk system links accounts by graph, banning one account triggers an automated review of all cluster members — not just the flagged one. An agency that had five well-performing client accounts in a cluster can lose all five in a single enforcement action triggered by one account’s policy violation.
Isolation Checklist for Reducing Detection Surface
-
1
Unique fingerprint per profile — use an anti-detect browser that assigns different canvas, WebGL, and font values per profile. Verify with PixelScan before any live login.
-
2
Dedicated residential proxy per profile — residential IPs from dedicated (not shared) pools. Confirm the proxy city matches the profile’s timezone setting.
-
3
Separate payment instruments — different cards per client cluster. Even a virtual card (Wise, Privacy.com) with a different BIN provides payment-layer separation.
-
4
Never copy cookies between profiles — importing a banned session’s cookies into a new profile brings the banned fingerprint’s history with it, instantly linking the new account to the cluster.
Read how multi-accounting works for the operator-side mechanics, and how to keep track of multiple accounts for the organizational layer that keeps isolation from degrading over time.
Try RoxyBrowser free — separate fingerprint profiles with proxy binding eliminate the two highest-weighted detection signals in the table above.
Related guides
- How does multi-accounting work
- How accurate is browser fingerprinting
- How to keep track of multiple accounts
Frequently Asked Questions
How do platforms detect multi-accounting?
By correlating five signal categories: shared cookies, shared IP or subnet, matching payment instruments, identical browser fingerprints, and behavioral overlap. Matching on two or more signals is typically enough to cluster accounts together.
Can platforms see through Chrome profiles when detecting multi-accounting?
Yes. Chrome profiles separate cookies but share the hardware fingerprint. Platforms reading canvas hash, WebGL renderer, and fonts will identify both profiles as the same device.
Do VPNs prevent multi-account detection?
No. VPNs change the IP address but leave canvas hash, WebGL, fonts, and timezone unchanged. These hardware signals remain as linking evidence even with a VPN active.
Will one banned account cause others to be banned?
Often yes, if the accounts share signals. When a ban triggers a cluster review, all accounts linked by shared fingerprints, IPs, or payment methods get audited and may be suspended simultaneously.
